Network Logs Monitoring and Analysis CCT Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A SIEM receives logs from multiple sources with different timestamp formats (e.g., 'dd/MM/yyyy:HH:mm:ss' and 'yyyy-MM-ddTHH:mm:ssZ'). The analyst needs to search for events between 10:00 and 10:15 UTC. What is the best approach?

   • AConfigure the SIEM to parse and convert all timestamps to a single normalized UTC format.
   • BSearch each log source separately using its native format.
   • CUse the SIEM's default time zone and ignore the differences.
   • DConvert all logs to a spreadsheet and manually align timestamps.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company has a 90-day operational log retention policy, but legal requires retaining logs for 7 years for a lawsuit. Storage costs are a concern. What is the most cost-effective strategy that meets both requirements?

   • AStore logs only in cold storage from day one.
   • BDelete logs after 90 days to save costs.
   • CStore logs in hot storage for 90 days, then move them to low-cost cold/archive storage for the remaining period.
   • DKeep all logs in hot storage for 7 years to ensure fast access.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary goal of correlating log events from multiple sources?

   • ATo reduce the total number of logs stored
   • BTo encrypt logs from different sources
   • CTo replace the need for individual log analysis
   • DTo identify complex attack chains that span multiple systems
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security analyst is investigating a potential privilege escalation. The authentication logs show a user logging in with a standard account, and then the same user's account is used to create a new admin account. The application logs show the admin account being used to access sensitive data. What is the best way to confirm the attack chain?

   • AReview the IDS logs for alerts on the user's activity.
   • BCorrelate the authentication, application, and system logs to trace the exact sequence of events and identify the method of privilege escalation.
   • CLook at the user's browser history to see what websites they visited.
   • DCheck the firewall logs for outbound traffic from the user's machine.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company has multiple remote offices that generate logs. They want to centralize these logs at headquarters for analysis. The WAN links are slow and sometimes unreliable. What is the most robust method for log collection?

   • AStore logs only at each office and never centralize.
   • BUse a central server to pull logs from each office over the WAN.
   • CHave each office manually email logs to headquarters daily.
   • DDeploy local log forwarders that buffer logs and forward them reliably to the central server.
   Reveal Solution Discussion Select an answer first